Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teach…

A Stored XSS vulnerability exists in Chamilo learning management system's glossary function prior to version 1.11.30. The vulnerability allows users with Teachers role to inject malicious JavaScript code targeting administrators. The issue enables privilege escalation attacks where lower-privileged teachers can execute code in the context of system administrators. This represents a significant security risk in educational environments where multiple user roles interact. The vulnerability has been patched in version 1.11.30 with multiple GitHub commits addressing the issue.